hns-lsel-applier

# hns-lsel-applier — LSEL APPLY engine

> **Namespace:** `hns-lsel-*` is user-owned dogfood (CLAUDE.local.md §24). This skill
> is NOT mirrored into `internal/template/templates/` — it lives only in this repo.
> Graduation to `moai-lsel-*` + 16-language distribution is a separate SPEC
> (out of scope per spec.md §G).

> **Token discipline.** This body deliberately avoids the literal identifier of the
> frozen Go applier's write-flag and the literal name of the orchestrator-only
> user-question channel. Both are referenced by location and role (e.g. "the write-flag
> at `internal/harness/applier.go:22`", "the orchestrator's synchronous user gate") so
> the REQ-LSEL-003 invariant-grep and the E4 subagent-boundary grep over LSEL surfaces
> read zero literal matches. The invariants themselves are stated in plain English.

## What this skill does

The LSEL loop's PROPOSE→APPLY seam was dead in production: `Applier.Apply` never ran
(`manifest.jsonl` absent), `CuratorDispatch` had 0 production callers, and the frozen
Go applier's write-flag at `internal/harness/applier.go:22` (kept `false`) is the
apply dead-switch (REQ-LSEL-003 — M3 keeps it `false` by BYPASS, never unfreeze). The
M3 closure routes APPLY through a parallel **user-owned** applier that writes only to
the six evolvable surfaces (spec.md §B.3), while the frozen Go applier stays
byte-for-byte frozen. Design SSOT:
`.moai/reports/moai-local-self-evolution-design-20260804.html` §4 ("동결된 Go applier를
우회하는 병렬 사용자 소유 applier를 세운다" — build a parallel user-owned applier that
bypasses the frozen Go one) + §7 (the two-round critique moved the allowlist OUT of
the evolvable skill files into a frozen meta file, and added execution-meta files to
the forced-gate set).

The APPLY engine is the **playback hook** `.moai/hooks/lsel-apply.sh` plus this skill's
model-mediated judgment (target validation nuance, approval-marker provenance, blast-
radius reasoning the mechanical hook cannot see). The hook is the load-bearing safety
floor; this skill is the consumer-facing surface that decides WHICH approved decision
to feed it next and how to interpret refusal.

## The APPLY pipeline

`lsel-apply.sh <decision.json>` performs five steps. Steps 1-2 are the safety floor;
steps 3-5 are the playback.

1. **Frozen-allowlist hard-reject** (REQ-LSEL-001 / AC-LSEL-001). The target path in
   `decision.json` is matched against the `frozen_patterns` regex list in
   `.claude/lsel/frozen-allowlist.json`. A match → REFUSE: a row is appended to
   `.moai/logs/lsel-reject.log` naming the rejected path and category `frozen-path`,
   NO file is written, and the hook exits 2.
2. **Execution-meta forced-gate** (REQ-LSEL-002 / AC-LSEL-005 D3 self-amending-
   handcuffs). If the target matches one of the four `execution_meta` categories —
   (i) the frozen allowlist meta file itself, (ii) an applier/curator skill body
   (`hns-lsel-applier/`, `hns-lsel-curator/`), (iii) the apply hook
   (`.moai/hooks/lsel-*.sh`), (iv) the `settings.local.json` hook-registration
   subblock — the hook checks `decision.json` for a synchronous-approval marker (a
   `synchronous_approval` object with `decision: "approved"`, produced by the
   orchestrator's synchronous user gate). No marker → REFUSE: reject-log row with
   category `execution-meta`, exit 3, no write. With marker → proceeds (the refusal
   is keyed on the absent marker, NOT on the category match alone). The refusal
   semantics mirror the M2 `csa_refusal_test.sh` fixture exactly.
3. **Apply the diff.patch** via `git apply` (playback of an already-approved decision).
   Only the paths declared in the patch are staged — never `git add -A` (working-tree
   hygiene).
4. **Append the apply-ledger row** to `.moai/state/lsel/apply-ledger.jsonl`:
   `{proposal_id, target_surface, ts, result:"applied", commit_sha, category}`. This
   is the manifest the frozen Go applier never produced, finally real in user-owned
   space.
5. **Commit** the staged change as ONE `feat(lsel-<proposal-id>): ...` Conventional
   Commit on the current (feature) branch (REQ-LSEL-004). The ledger row's
   `commit_sha` is backfilled from the commit's short SHA.

A no-arg invocation is a clean no-op (exit 0) so an empty approved-queue does not
derail a loop pass.

## The model-mediated layer (you, when invoked)

When this skill is invoked to drive an APPLY pass, your job on top of the mechanical
hook is:

- **Read the proposal's `proposal.md` + `self-critique.md`** at
  `.moai/state/lsel/proposals/<id>/`. A proposal with `status: blocked` (any
  UNRESOLVED self-critique objection) MUST NOT be fed to the hook — return a blocker
  report instead.
- **Confirm the approval marker's provenance.** The `synchronous_approval` object must
  carry a real orchestrator-produced approval artifact (the synchronous user-question
  channel the orchestrator owns per CLAUDE.md §8). A marker the loop fabricated for
  itself is the self-amending-handcuffs failure mode (REQ-LSEL-002); the hook's
  mechanical check is the floor, your provenance judgment is the ceiling. This skill
  is a subagent mechanism and NEVER invokes the orchestrator-only user-question
  channel; return a blocker report and let the orchestrator run the gate.
- **Re-verify the frozen-allowlist invariant** by grepping the write-flag at
  `internal/harness/applier.go:22` — it MUST stay `false`. If M3's bypass ever drifts
  toward unfreezing the Go applier, return a blocker (AP-LSEL-002).

## What this skill does NOT do

- **No unfreezing of the Go applier** — the write-flag at
  `internal/harness/applier.go:22` stays `false` (REQ-LSEL-003). The bypass is
  parallel and user-owned; the frozen applier is reference-only.
- **No edits to frozen doctrine** — `internal/template/templates/**`,
  `.claude/rules/moai/**`, `CLAUDE.md`, retained agents, `moai-*` skills, the frozen
  Go applier / `curator_dispatch.go`, and `.moai/config/sections/**` are
  byte-for-byte untouched. The allowlist hard-rejects them (step 1).
- **